How to use the HTML Escape & Unescape
- Choose Encode to escape text, or Decode to turn entities back into characters.
- Paste your text or HTML on the left. The result updates as you type.
- When escaping, tick Also escape non-ASCII to turn characters like é, ✓ or emoji into numeric entities for systems that only accept ASCII.
- Click Copy, or ⇅ Use as input to run the result through again.
Why escape HTML?
Characters like < and & have special meaning in HTML. To show them on a page, for example a code sample in a blog post or user input in a comment, they must be written as entities. Otherwise the browser treats them as tags, which breaks the layout and, with user input, opens the door to cross-site scripting (XSS).
| Character | Entity | Why |
|---|---|---|
& | & | Starts every entity |
< | < | Starts a tag |
> | > | Ends a tag |
" | " | Ends an attribute value |
' | ' | Ends a single-quoted attribute |
Named, decimal and hex entities
The same character can be written three ways: é, é and é all mean é. The decoder understands all of them, including the full list of more than 2,000 HTML5 names. Numeric entities work everywhere, while named ones are easier to read.
Escaping in code
| JavaScript | Set element.textContent instead of innerHTML, and the browser escapes for you |
|---|---|
| Python | html.escape(text) / html.unescape(text) |
| PHP | htmlspecialchars($text, ENT_QUOTES) / html_entity_decode($text) |
| Java | StringEscapeUtils.escapeHtml4(text) (Apache Commons Text) |
| C# | WebUtility.HtmlEncode(text) / HtmlDecode |
Frequently asked questions
What's the difference between HTML escaping and URL encoding?
HTML escaping makes text safe inside a web page (< becomes <). URL encoding makes text safe inside a web address (a space becomes %20). Use the URL encoder for links and query strings.
Why do I see &amp;lt; instead of <?
The text was escaped twice. Decode it, then click ⇅ Use as input and decode again. The tool warns you when the result still contains entities.
Is escaping enough to stop XSS?
It's the main defense for text placed between tags and inside quoted attributes. Text inside <script>, style blocks or unquoted attributes needs different handling, so use your framework's built-in escaping where you can.
Is my text uploaded?
No. Encoding and decoding happen in your browser and nothing is sent anywhere.